From 19283e2ca97128fc13078fdca44f8a4e530e6d59 Mon Sep 17 00:00:00 2001 From: "Matthew N. Heler" Date: Sun, 26 Jul 2026 10:37:42 -0500 Subject: [PATCH] mgr/smb: create rgw keys with the rgw profile Replace mon 'allow *' and the osd tag cap with the rgw profile. The profile covers pool creation on first write, which is what the mon cap was there for. auth get-or-create refuses an entity that already exists with different caps, so fall back to auth caps. Anything created before this carries the old caps and would error on the next apply. Signed-off-by: Matthew N. Heler --- src/pybind/mgr/smb/rgw_auth.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/pybind/mgr/smb/rgw_auth.py b/src/pybind/mgr/smb/rgw_auth.py index fbe873fd441..576e0939187 100644 --- a/src/pybind/mgr/smb/rgw_auth.py +++ b/src/pybind/mgr/smb/rgw_auth.py @@ -33,9 +33,9 @@ class RGWAuthorizer: if not caps: caps = [ 'mon', - 'allow *', # Required for pool creation on first write to empty RGW buckets + 'profile rgw', # covers pool creation on first write to empty RGW buckets 'osd', - 'allow rwx tag rgw *=*', + 'profile rgw', ] cmd = { @@ -46,5 +46,9 @@ class RGWAuthorizer: log.info('Requesting RGW authorization: %r', cmd) ret, _, status = self._mc.mon_command(cmd) if ret != 0: - raise RGWAuthorizationGrantError(status) + ret, _, status = self._mc.mon_command( + {'prefix': 'auth caps', 'entity': entity, 'caps': caps} + ) + if ret != 0: + raise RGWAuthorizationGrantError(status) log.info('RGW authorization request success: %r', status)